A practical SPF, DKIM and DMARC setup guide for cold email, built from running authentication across 100+ sending domains.
Kyle Dickson
SPF, DKIM and DMARC are three DNS records that prove your cold email is really from you. SPF lists the servers allowed to send for your domain. DKIM adds a cryptographic signature that proves the message was not altered. DMARC ties both back to the domain in your From address and tells inbox providers what to do when the check fails.
Get all three right and your mail is eligible for the inbox. Get one wrong and every campaign underneath it silently degrades, usually without a bounce message to tell you why.
Each protocol answers a different question for the receiving mail server. They are not redundant, and passing two out of three is not a passing grade for cold outbound.
SPF (Sender Policy Framework) is a DNS text record that lists which mail servers are authorized to send email for your domain. The receiving server looks up the record, checks the IP that actually delivered the message, and marks it pass or fail. SPF alone proves nothing about the visible From address, which is why it was never enough on its own.
DKIM (DomainKeys Identified Mail) is a cryptographic signature that proves a message came from your domain and was not modified in transit. Your sending platform holds a private key and signs every outbound message. The matching public key sits in DNS under a selector name the platform chooses. The receiver fetches the key and verifies the signature.
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a policy record that tells receiving servers what to do when SPF or DKIM fail. It adds the piece the other two lack: alignment. DMARC requires that the domain validated by SPF or DKIM matches the domain your recipient actually sees in the From field.
| Protocol | What it proves | Where it lives |
|---|---|---|
| SPF | Server is authorized | Root domain TXT record |
| DKIM | Message was not altered | Selector subdomain record |
| DMARC | From address matches | Underscore dmarc subdomain |
Authentication stopped being optional in February 2024. Google and Yahoo now require bulk senders, defined as anyone sending 5,000 or more messages per day to their addresses, to publish SPF, DKIM and DMARC, pass domain alignment, and support one-click unsubscribe on marketing mail.
Google also publishes a hard number on complaints. Keep the spam rate reported in Postmaster Tools below 0.10%, and never let it touch 0.30%. Cross that ceiling and Google throttles you, then considers mitigation only after you have stayed under it for several consecutive days.
Microsoft went further. Since 2025, Outlook.com, Hotmail and Live reject non-compliant mail from high-volume senders outright with a 550 5.7.515 error stating the sending domain does not meet the required authentication level. That is a rejection, not a spam folder. If you have ever wondered why a segment of your list simply never replies, this is a strong candidate.
None of this changes the fundamentals of good outbound, but it does change the floor. Authentication is now the entry fee. What you build on top of it, from list quality to sequencing, is covered in our guide to running a cold email agency program.
SPF is a single TXT record published at the root of your sending domain. It opens with the version tag, lists one include entry per sending provider, and closes with a soft fail marker so anything unlisted is treated as suspicious rather than dropped.
The setup takes four steps:
Two rules matter more than the rest. Never publish two SPF records on one domain, because both will fail and every message underneath them fails with them. And keep the record under ten DNS lookups. Each include entry can trigger further lookups behind the scenes, and once you pass ten the record returns a permanent error and SPF stops passing entirely.
DKIM takes more steps than SPF because it involves a key pair. Your sending platform generates the keys, keeps the private half, and gives you a hostname and a long value to publish in DNS.
If you route mail through more than one platform on the same domain, publish a separate DKIM record for each. They live under different selectors and do not conflict. The most common failure here is generating the key, publishing the record, and forgetting to flip signing on inside the platform. The record exists, nothing signs against it, and DKIM quietly fails.
Start at monitor-only. A DMARC record is a TXT entry on the dmarc subdomain, and its policy tag accepts three values: none, quarantine or reject. For a fresh cold email domain, publish the policy as none with a reporting address attached, and leave it there through warmup.
Monitor-only satisfies the Google, Yahoo and Microsoft requirement while you collect aggregate reports showing exactly which sources are sending as your domain. After a few clean weeks, tighten to quarantine. Most cold email domains never need reject, because quarantine already delivers the reputation benefit without risking legitimate mail.
Alignment mode is the tag people ignore and then get burned by. Relaxed alignment accepts a subdomain match, strict demands an exact match. Relaxed is the right default for cold outbound, where sending platforms frequently use a subdomain on the return path.
Order matters because DMARC evaluates the other two. Publishing DMARC first means you are enforcing a policy against records that do not exist yet.
You are looking for three passes in that header block: SPF, DKIM and DMARC. Two passes and a neutral is not good enough. Run the same test to an Outlook address, since Microsoft enforcement is stricter and will surface problems Gmail tolerates. Then connect the domain to Google Postmaster Tools so you have complaint and reputation data from day one rather than after the damage.
Every generic guide assumes one domain and one marketing list. Cold outbound at scale works differently, and the differences are where most programs break.
We run 100-plus warmed sending domains on Scaled Mail and send through Instantly with inbox rotation. Cold email never touches a client's primary domain. That domain carries invoices, contracts, password resets and support threads, and a single reputation hit there costs more than any campaign is worth. Burner sending domains isolate the risk.
Volume is controlled per inbox, not per campaign. We cap sends at 20 to 50 per inbox per day and scale by adding inboxes rather than pushing more mail through the same ones. This keeps each individual domain far below any bulk-sender threshold while the program as a whole sends serious volume.
Warmup is not optional and it is not fast. Every new domain warms for two to four weeks before it touches a real prospect. Authentication records go in on day one of that window so the entire warmup period accrues to a properly authenticated domain.
The operational cost of this model is auditing. One hundred domains means one hundred SPF records, one hundred or more DKIM selectors, and one hundred DMARC policies, each capable of failing independently. A single domain with a broken DKIM key does not announce itself. It just underperforms, drags your aggregate numbers down, and hides inside the rotation. Audit authentication across the full estate on a schedule, not just at provisioning, and pair that with the targeting discipline in our cold email strategy breakdown.
These are the failures that produce no bounce, no warning and no obvious symptom beyond a reply rate that will not move.
Alignment deserves its own note. SPF and DKIM can both pass while DMARC still fails, because DMARC checks whether the authenticated domain matches the visible From domain. If your platform signs with its own domain and your From address is yours, nothing aligns and DMARC fails despite two green checks. This is the single most misdiagnosed deliverability problem in cold email, and it looks identical to a bad subject line from the outside. Getting it right is foundational to any serious pipeline generation effort.
Yes. The 5,000-per-day threshold defines who is strictly required to comply, but inbox providers treat a published DMARC policy as a positive trust signal at any volume. Publishing it costs one DNS record. Skipping it means competing against senders who have it while offering receivers less reason to trust you.
Alignment. DMARC does not just ask whether SPF and DKIM passed. It asks whether the domain that passed matches the domain in your visible From address. If your sending platform authenticates under its own domain, both checks pass and DMARC still fails. Fix it by aligning the signing domain to your sending domain.
Start at none while warming, then move to quarantine once aggregate reports come back clean. Quarantine captures nearly all of the reputation benefit. Reject adds risk without much upside for a dedicated sending domain, and a misconfiguration under reject kills an entire domain's mail flow instantly.
DNS propagates in five to thirty minutes, but authentication readiness is not sending readiness. Verify all three pass on a live test, then warm the domain for two to four weeks before it touches a real prospect. Records published on a cold domain do not substitute for reputation you have not built yet.
No. SPF is published per domain, so each sending domain needs its own record. The content is often identical across an estate, which makes templating straightforward, but the record itself must exist on every domain. A domain missing its record fails SPF regardless of what its neighbors have published.
Authentication is the part of cold email nobody notices until it breaks, and by then you have burned a domain and a quarter of pipeline you will never see. If you would rather have someone audit your setup and run the infrastructure properly, book a call and we will walk through your current records and where they are leaking.
The problem with your ads isn't your targeting or budget. It is your creative!
GET MY FREE CREATIVEIf you'd rather talk it through — your channels, your current CAC, where your pipeline is leaking, and what a full paid program with creative and landing pages built in would look like — book a strategy call and we'll map it against your numbers. No obligation, and if we're not the right fit for your ACV or motion, we'll say so.
Book a strategy call
.png)
.png)
.png){kind=small}
.png){kind=small}
.png){kind=small}
.png){kind=small}